Scattered Spider (UNC3944) Cybercrime Group Laying New Eggs

**Executive summary:** This report profiles Scattered Spider (aka UNC3944 / Scatter Swine / 0ktapus / Muddled Libra / Octo Tempest), a financially motivated intrusion set active since 2022 that uses advanced phone-based social engineering, SIM swapping, AiTM phishing, RMM tools and legitimate file-hosting services to exfiltrate data and operate as a BlackCat ransomware affiliate; the report provides TTPs, IoCs (phishing domains and server IPs), victim lists, timelines and tools used across 2022–2024 to support detection and response.